CVE-2026-11301: Chrome LiveCaption Out-of-Bounds Memory Access (CVSS 8.8)

Technical summary

CVE-2026-11301 is an out-of-bounds (OOB) read/write vulnerability (CWE-125) in the LiveCaption component of Google Chrome versions prior to 149.0.7827.53. The flaw stems from improper bounds checking when processing network input, enabling an unauthenticated remote attacker to read or modify memory outside the intended buffer. The vulnerability manifests through malicious network traffic and can result in arbitrary information exposure or potential code execution in certain scenarios, though the latter would depend on additional factors such as heap layout and memory protections in place.

Business impact

Organizations and users relying on Chrome for daily work face potential data exfiltration risks if attackers send crafted network packets to users' machines. For enterprises, this could expose sensitive information visible in memory at the time of exploitation, particularly if users have cached credentials, session tokens, or sensitive documents in memory. The requirement for user interaction lowers the immediate enterprise blast radius, but the high CVSS score reflects the severity of potential outcomes if exploitation occurs. Reputational and compliance implications depend on whether sensitive personal or regulated data is compromised.

Affected systems

Google Chrome versions prior to 149.0.7827.53 are affected. The vulnerability impacts Chrome running on Windows, macOS, and Linux systems. While the CVE references these operating systems in the vendor-products list, the vulnerability itself is in Chrome's code; the OS serves as the platform. Users on any of these operating systems with unpatched Chrome installations are at risk.

Exploitability

The attack requires network proximity in the sense that the attacker must be able to send malicious network traffic to the target. This could occur through various vectors: a compromised network infrastructure, a malicious website, DNS hijacking, or any mechanism allowing the attacker to inject crafted packets toward the victim. User interaction is required—the user must be actively using Chrome at the time the malicious traffic is received. The absence of privilege requirements and the straightforward attack surface (network input) means that once delivery is achieved, exploitation is likely to succeed against vulnerable versions.

Remediation

Update Chrome to version 149.0.7827.53 or later immediately. Administrators managing Chrome across an organization should use Group Policy (Windows) or Mobile Device Management (macOS/Linux) to enforce automatic updates or block older versions. For individual users, enable automatic Chrome updates in Settings > About Google Chrome. As an interim measure until patching is complete, restrict network access from untrusted sources if possible, though this is not a substitute for patching.

Patch guidance

Verify that Chrome has been updated to version 149.0.7827.53 or later by navigating to Chrome menu > Help > About Google Chrome, which will display the current version and auto-update if necessary. For enterprise deployments, consult Google's Chrome Enterprise release notes to confirm the patch version rollout timeline. Test updates in a non-production environment first if your organization manages custom Chrome configurations. Note that this CVE was published June 5, 2026, so patch availability should be confirmed against current vendor advisories.

Detection guidance

Monitor for Chrome version compliance across your infrastructure using Mobile Device Management (MDM) or endpoint detection and response (EDR) tools. Network-based detection is difficult because the malicious input is protocol-agnostic; focus instead on identifying systems still running Chrome versions prior to 149.0.7827.53. If available, enable Chrome crash reporting and monitor for unexpected crashes or memory protection violations in LiveCaption processes. Behavioral detection could flag unusual memory access patterns, though this requires deep packet inspection and may produce false positives.

Why prioritize this

Although Chromium's internal severity assessment was 'Low,' the CVSS 3.1 score of 8.8 reflects a HIGH severity vulnerability due to the combination of remote exploitability without authentication, relatively low attack complexity, and severe impact (confidentiality, integrity, and availability all achievable). Out-of-bounds memory access in a widely used browser component warrants swift patching. Prioritize patching for endpoints handling sensitive data or high-risk users (executives, finance, legal). The lack of active exploitation (KEV not marked) provides a brief window before adversaries likely develop reliable exploits.

Risk score, explained

The CVSS 3.1 vector (8.8 HIGH) reflects: AV:N (network-accessible attack surface), AC:L (low attack complexity—no special conditions needed), PR:N (no prior privileges required), UI:R (user interaction required—user must be using Chrome), S:U (scope unchanged), C:H/I:H/A:H (all three impact categories at maximum). The high score appropriately captures the severity of unrestricted memory access despite the 'Low' Chromium rating, likely because the Chromium rating considered mitigating factors (like Chrome's sandbox) that CVSS does not fully account for in isolation. The UI:R factor prevents this from being a 9.0+, as user presence is necessary.

Frequently asked questions